Hack(ing) Magic Trackpad SPI Protocol

I’ve been wanting to get into apple’s Magic Trackpad since they announce it, i got it as it came out but at start was a bit disapointing.

Followed the iFixIt Teardown, and when i saw the UPTX and UPRX words i was excited with the possibility of getting inside quickly, soldered some wires to the solder pads and hook them up to the Saleae Logic (amazing tool btw) but nothing was going on there, i thought it would be impossible and leaved it on the side for the last weeks.

Today i feeled like getting back to it and give it another try, got Logic software on and started probing all of the other numbered solder pads on the pcb. After some tests i managed to find out some specific points that behave like a SPI protocol, assigned pad TP53 to MOSI, pad TP54 to MISO, TP55 to CLOCK and TP56 to Enable, Logic started decoding the captured data and everything started to make sense! Already understood the data structure, now i’m looking into understanding what all the bits and bytes do, where’s my xy positions and fingers id’s??

Because the trackpad works via bluetooth it only transmits data if it is connected to a device, another thing to do will be to trick the bluetooth IC to think that it’s always connected and transmit data all the time.

I’m sharing the data in Saleae Logic data files, in case someone is interested in the same thing: download here>
The application is free to download at they’re website…

Next step will be to connect it to an Arduino to decode and try to store the byte maps captured and learn from them…